Data controller
- Controller: Estudio Fenix Software S.L
- Tax ID (NIF): B93836096
- Address: Carrer de Nil Fabra, 30, 08012 Barcelona
- Data protection contact: contact form or by post to the address above
Who this policy applies to
It explains how we process the personal data of:
- Customers: the organizers who create an account and buy the service, and the team members they invite.
- People who use the service without an account: whoever speaks through an audio guide link, whoever joins an intercom with a position's QR code or an audio hub's link, and the attendees who listen.
- Website visitors and anyone who writes to us through the contact form.
What data we process, why and on what legal basis
Customers and their teams
- Account data: name, email, password (stored with irreversible encryption), language, company and, if you provide them, billing details (legal name, tax ID and address). To create and manage your account and provide the service. Legal basis: performance of the contract.
- Payments: processed by Stripe; we never see or store your full card number. We keep the amount, date and status of each payment. To charge for licenses. Legal basis: performance of the contract.
- Invoicing: the details of each purchase are sent to the owner's invoicing system, which issues the invoice. Legal basis: compliance with legal obligations (tax and commercial law).
- Service use and security: sign-ins, IP address and browser, actions taken in the dashboard (audit log) and usage statistics (rooms, intercoms, people connected, duration). To keep the service secure, prevent abuse, resolve incidents and improve the service. Legal basis: legitimate interest.
- Service communications: the emails needed to use it (email verification, password recovery, purchase confirmations and service notices). Legal basis: performance of the contract.
People who use the service without an account
- Device identifier: a random code stored in the browser that lets us recognize a reconnection from the same device and avoid counting the same person twice.
- Name: only in the intercom and only if you choose to type it, so the rest of the team knows who is talking.
- Technical connection data: IP address, browser, connection quality and duration.
- Voice: transmitted live to whoever should hear it according to the organizer's setup. It is never recorded or stored.
We process this data to provide the service the event organizer has purchased, count the people connected at once, keep connections reliable and secure, and produce usage statistics. In these cases the organizer is the data controller and is responsible for informing their team and attendees; we process the data on their behalf, as a data processor, under the Terms of use and sale.
Contact form
Name, email, company, phone and message, to reply to you. Legal basis: your consent when you send it and, if you ask about the service, taking steps prior to entering into a contract.
Website visit statistics
To know how many people visit the website, how they find us and which campaigns work, we measure visits to the public pages with our own system, without cookies or anything stored in your browser and without sending this data to third parties:
- What we record: the page you view, the domain of the website you come from, the link's campaign parameters (utm), the type of device, the browser and operating system family (for example, “Chrome” or “Android”) and your approximate country, which Cloudflare provides based on the connection.
- Your IP address is not stored. To count visitors, a pseudonymous identifier is calculated from your IP and browser; it changes every day and cannot be used to recognize you from one day to the next.
- If you sign up or start a purchase during that visit, the visit is linked to your account or to that purchase, so we know which channel or campaign brought it.
Legal basis: our legitimate interest in understanding how the website is used and measuring our campaigns (Article 6(1)(f) GDPR). We keep this data for 25 months. You can object at any time by writing to us through the contact form; in addition, if your browser sends the Global Privacy Control or “Do Not Track” signal, we do not record your visits.
Recipients and providers
We do not sell or share your data with third parties, except where required by law. To provide the service we use providers that process data on our behalf, under the corresponding data processing agreements:
- OVHcloud (OVH SAS, France): hosting of the website, database and audio servers, in the European Union.
- Cloudflare (Cloudflare Inc., United States): content delivery and protection of the website.
- Stripe (Stripe Payments Europe Ltd., Ireland): payment processing.
- Resend (Resend Inc., United States): email delivery.
- Google (Google Ireland Ltd., Ireland): sign-in with Google, only if you choose it.
Transfers to providers located outside the European Economic Area are covered by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.
How long we keep data
- Account: while it is active. If you ask us to close it, the data is blocked and deleted once the legal retention periods have ended.
- Payments and invoices: 6 years under the Spanish Commercial Code, plus any periods required by tax law.
- Technical connection data and statistics: for as long as they are needed for the security of the service and its usage statistics.
- Contact form messages: for as long as needed to deal with your request.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to us using the contact form or by post to Carrer de Nil Fabra, 30, 08012 Barcelona, stating which right you want to exercise. If you are part of an event team or an attendee, you can also contact the organizer.
If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security
All communication with the website and all audio is encrypted (HTTPS and DTLS-SRTP). Passwords are stored with irreversible encryption and the keys for external services are encrypted. Access to data is limited to the staff who need it for their work.
Minors
The service is intended for professional organizers who are of legal age. Attendees and teams do not need to register; if minors take part, the organizer is responsible for obtaining the necessary authorizations.
Changes to this policy
If we change it, we will publish the new version on this page and, if the change is significant, notify customers by email.